The 14-Year Grudge: How a Reddit Moderator Used AI to Hack a Star Wars Galaxies Emulator

The community surrounding Star Wars Galaxies (SWG), the seminal sandbox MMORPG shut down by Sony Online Entertainment (SOE) in 2011, has long been celebrated for its passion and dedication to preservation. For over a decade, volunteer-run emulator projects have kept the galaxy far, far away alive for thousands of players.

However, this tight-knit community was recently rocked by a high-profile security breach. A prominent moderator of the r/swg subreddit, operating under the alias "Levarris" (or "levarrishawk"), successfully decrypted the client-side game assets of Star Wars Galaxies Legends—the largest and most active emulator server currently running.

In an extraordinary twist, the hacker openly admitted to the breach, revealing that the attack was executed using artificial intelligence tools. More surprising still was the motive: a deep-seated, 14-year-old grudge involving allegations of hoarded developer tools and underground community politics dating back to the twilight years of the original game.

Main Facts of the Security Breach

The security incident targeted Star Wars Galaxies Legends (often simply referred to as SWG Legends), an emulator server famous for preserving and expanding upon the controversial "New Game Enhancements" (NGE) era of the game. Unlike other servers that focus strictly on replicating the game as it existed in 2011, Legends actively develops custom content, including new planets, unique questlines, custom space sectors, and exclusive items.

What Was Compromised?

According to official statements from both the SWG Legends development team and the perpetrator, the breach was limited to client-side assets.

• Decrypted Client Files: The hacker used AI-assisted tools to bypass the server’s proprietary client-side encryption. This granted access to all of Legends’ custom-made assets, including 3D models, textures, custom quest structures, and item data.
• Asset Distribution: Following the decryption, Levarris actively offered these proprietary files to rival emulator projects, potentially allowing other servers to clone Legends’ exclusive content.

What Remained Secure?

Crucially, the SWG Legends team confirmed that the breach did not compromise the server’s backend database.

• No player account information, passwords, email addresses, or personal data were accessed.
• The server’s live database and infrastructure remained completely intact and secure.

Chronology of a 14-Year Feud

To understand why a subreddit moderator would target a fan-made server for a defunct game, one must trace the timeline of the Star Wars Galaxies emulation scene back to the late 2000s.

[2003] Star Wars Galaxies Launches
  │
[2010-2011] Leaked SOE Developer Tools / "Honeypot" Incident
  │
[2011] Official SWG Servers Shut Down
  │
[2015-2016] SWG Legends Launches (utilizing NGE codebase)
  │
[Recent] Levarris Decrypts Legends Client Assets using AI Tools
  │
[Post-Breach] SWG Legends Issues Discord Warning
  │
[Post-Breach] Levarris Publishes Confession/Justification on r/swg

1. The Genesis of the Grudge (2010–2011)

During the final years of the official Star Wars Galaxies live service, proprietary developer tools and source files owned by Sony Online Entertainment began leaking into the broader community. According to Levarris, certain individuals—who would later go on to help establish and develop SWG Legends—allegedly set up a "honeypot" scheme. This scheme was reportedly designed to gather these leaked SOE tools from various community members under the guise of shared development, only for the group to withhold the tools from other emulator developers. This alleged hoarding of developmental resources created a massive, permanent schism within the early preservation community.

2. The Rise of SWG Legends (2015–Present)

While other emulation groups worked on rebuilding the game’s pre-CU (Combat Upgrade) codebase from scratch, SWG Legends utilized leaked source code to run a stable version of the post-NGE game. Over the years, the Legends team grew into a highly organized group of hobbyist developers, artists, and programmers. To protect their hundreds of hours of custom-coded content from being easily copied by rival servers, the Legends team implemented custom encryption on their client-side files.

3. The Decryption and Leak

Utilizing modern artificial intelligence tools to accelerate the reverse-engineering process, Levarris targeted the Legends client. By automating the identification of cryptographic patterns, the AI tools successfully cracked the custom client-side encryption, exposing the server’s proprietary assets.

4. The Public Disclosures

Following the successful decryption, the SWG Legends team discovered the leak and issued an announcement to their player base via Discord. Shortly thereafter, Levarris published a detailed post on the r/swg subreddit, confirming their identity as the hacker and laying out the historical grievances that motivated the attack.

Technical and Supporting Data

The breach highlights a growing trend in the cybersecurity landscape: the democratization of reverse-engineering through artificial intelligence.

The Role of AI in Reverse Engineering

Historically, decrypting custom-packaged game archives (such as the .tre files used by Star Wars Galaxies) required extensive manual assembly analysis, debugger tracing, and deep cryptographic knowledge.

By leveraging modern LLMs (Large Language Models) and AI-driven decompilers, bad actors can now:

1. Automate Code Analysis: Translate complex, compiled assembly code into readable pseudo-C++ code in seconds.
2. Identify Cryptographic Keys: Train machine learning models to scan binary code for entropy signatures that indicate where encryption keys or custom hashing algorithms are located.
3. Generate Custom Decryption Scripts: Instruct AI assistants to write python scripts to unpack proprietary archive formats once the cryptographic logic is identified.

In their public admission, Levarris specifically cited the use of AI tools as the catalyst that allowed them to bypass security measures that had previously kept Legends’ custom assets secure for years.

Official Responses and Community Backlash

The fallout from the breach was met with starkly contrasting statements from the SWG Legends staff, the hacker, and the community at large.

The SWG Legends Staff Statement

The development team behind SWG Legends addressed the situation on their official Discord server, choosing transparency over panic:

"We’ve confirmed that Levarris, aka levarrishawk from r/swg, used AI tools to decrypt our client-side game asset files. This gave him access to assets from all of our custom content: items, questlines… We do know that he’s actively offered these files to other servers, and while we can’t confirm that he’s had any takers yet, if you start seeing Legends’-exclusive content out in other worlds, it was likely taken from us.

We’re obviously bothered by this, but there isn’t much we can do outside of being upfront with all of you and staying focused on what makes Legends great."

The Hacker’s Defense

Writing on the r/swg subreddit, Levarris defended the hack not as an act of malicious vandalism, but as an act of community liberation. They argued that because Legends was built on the back of leaked, proprietary SOE code and allegedly "hoarded" tools, the current development team had no ethical right to protect their custom creations:

"You don’t get to protect and hoard from the greater community things built on stolen goods."

The Community’s Reaction

If Levarris expected the subreddit community to rally behind them as a digital Robin Hood, they were sorely mistaken. The response from everyday Star Wars Galaxies players was overwhelmingly negative. Most users expressed exhaustion over decades-old internet drama interfering with their leisure time.

Reddit user iceman2kx summed up the general sentiment of the player base:

"I’m just trying to play around with a lightsaber after working 60 hours in a week."

Another user, BroReesta, criticized the moderator’s abuse of power and disregard for the community’s stability:

"A moderator of the Star Wars Galaxies subreddit has decided to actively harm the Star Wars Galaxies community at large. Cool. Cool and good."

Many community members pointed out the hypocrisy of using "stolen goods" as a moral justification for hacking an emulator server, given that the entire emulation scene exists in a legal gray area utilizing intellectual property owned by Disney and Lucasfilm.

Broader Implications for MMO Emulation and AI Hacking

The SWG Legends security breach serves as a case study for several emerging challenges at the intersection of gaming, community management, and cybersecurity.

1. The Paradox of "Intellectual Property" in Emulation

Emulators exist in a legally precarious space. They are built on copyrighted code, assets, and trademarks that belong to massive corporations. Yet, within these communities, volunteer developers spend thousands of hours creating original content to keep the games fresh.

This creates a philosophical paradox:

• Does a fan-developer own the copyright to a custom-designed 3D model of a Star Wars blaster if it is hosted within a client based on copyrighted LucasArts code?
• If a server encrypts its client to prevent "theft" by other servers, are they violating the open-source spirit of emulation?

This breach has reignited these ethical debates, proving that even within underground communities, the concept of intellectual property remains highly contentious.

2. The Escalation of AI-Assisted Attacks on Independent Projects

While enterprise-level corporations are investing millions into AI-driven defense systems, volunteer projects and indie developers do not have access to such resources. The fact that a single subreddit moderator could leverage readily available AI tools to crack custom game encryption indicates a shifting power balance. As AI tools become more sophisticated, fan-made servers, modding communities, and indie games will find it increasingly difficult to protect their custom codebases and assets from malicious actors.

3. The Psychological Longevity of Online Communities

Finally, the incident highlights the intense, sometimes toxic longevity of MMO communities. Star Wars Galaxies has been dead officially for over a decade, yet the political rifts, personal grudges, and betrayals of its player base continue to influence the community in the present day. For some, the virtual galaxy remains a battleground where decades-old scores must be settled, regardless of the impact on the casual players who simply want to log in, explore Tatooine, and escape the real world for a few hours.